本文關鍵詞： IPsec IKEv2 安全聯盟 ESP AH　出處：《西安電子科技大學》2015年碩士論文　論文類型：學位論文

【摘要】：隨著互聯網的發展,頻繁的網絡攻擊(如DOS攻擊等)給企業和用戶造成了不可估量的危害,因此網絡安全愈來愈引起大家的關注。為了從IP層來解決網絡安全的問題,在1998年IETF(Internet Engineering Task Force)公布了IPsec安全標準,IPsec協議新標準為IP層及其上層的協議提供安全保障,包括:身份驗證、機密性以及密鑰管理等。安全聯盟是IPsec的關鍵,是成功建立IPsec安全隧道的前提條件。安全聯盟可以通過手工配置密鑰的方式進行建立,但是對于大型的組網來說,因為節點比較多,使用手工配置密鑰的方式容易導致工作量大、出錯率高。IKE協議能夠為IPsec提供自動交換密鑰、建立安全聯盟的服務,為IPsec的使用和管理提供方便,RFC2409中規定了早期IKE協議標準,但由于該標準比較復雜,而且部分協議作用有限。因此,IETF于2005年發布了IKE的第二版本,該版本簡化了協商的過程、增強了安全性。本文提出基于IKEv2方式建立IPsec安全隧道的機制,在IKEv1設計框架的基礎之上,對協商消息的構造、載荷的構造以及報文重傳機制進行更改,同時增加了SA重協商機制、Cookie-challenge機制。通過對以上的更改,使IKEv2具有更強的抗攻擊能力,密鑰交換能力更強,報文交互數量較少等特點。本文設計并實現了利用IKEv2方式建立IPsec安全隧道的機制,參考開源程序openikev2,采用C編程語言,基于Linux平臺開發設計,并應用在防火墻安全設備上,然后對IKEv2方式建立IPsec安全隧道進行測試,測試結果表明IKEv2能夠完成IPsec安全隧道的建立,同等條件下相對于IKEv1具有更高的協商速率。
[Abstract]:With the development of Internet, frequent network attacks (such as DOS attacks) have caused immeasurable harm to enterprises and users. Therefore, network security has attracted more and more attention. In order to solve the problem of network security from IP layer. In 1998, IETF(Internet Engineering Task Force released the IPsec security standards. The new standard of IPsec protocol provides security for IP layer and its upper layer, including authentication, confidentiality and key management. Security alliance is the key of IPsec. Security alliance can be established by manually configuring the key, but for large network, because there are more nodes. It is easy to use manual configuration of key to lead to heavy workload. Ike protocol with high error rate can provide automatic key exchange for IPsec and set up security alliance service. In order to provide convenience for the use and management of IPsec, RFC2409 provides for the early IKE protocol standard, but because of the complexity of the standard, and part of the protocol function is limited. In 2005, IETF released the second version of IKE, which simplifies the negotiation process and enhances security. This paper proposes a mechanism to build IPsec secure tunnel based on IKEv2. Based on the design framework of IKEv1, the structure of negotiation message, the construction of load and the mechanism of message retransmission are changed, and the SA renegotiation mechanism is added. Cookie-challenge mechanism. Through the above changes, IKEv2 has a stronger ability to resist attacks, and the ability of key exchange is stronger. This paper designs and implements the mechanism of establishing IPsec secure tunnel by IKEv2, referring to open source program openikev2 and using C programming language. Based on Linux platform development and design, and applied to firewall security equipment, and then IKEv2 way to build IPsec security tunnel for testing. The test results show that IKEv2 can complete the construction of IPsec secure tunnel, and the negotiation rate is higher than that of IKEv1 under the same conditions.
【學位授予單位】：西安電子科技大學
【學位級別】：碩士
【學位授予年份】：2015
【分類號】：TP393.08

【相似文獻】

相關期刊論文 前1條

1 葉潤國;范科峰;徐克超;蔡磊;;云安全聯盟安全信任和保證注冊項目研究[J];信息技術與標準化;2014年06期

相關碩士學位論文 前3條

1 張旭成;美國“亞太再平衡”戰略背景下的美澳安全聯盟研究[D];上海社會科學院;2015年

2 謝建豪;IPsec下IKEv2協議的研究與實現[D];西安電子科技大學;2015年

3 肖波;基于IPSec協議的安全聯盟設計及其應用[D];重慶大學;2013年

，

本文編號：1474141